dotrepo
io.github.maxwellsantoro/dotrepo
About dotrepo
dotrepo is an MCP server published by the GitHub account maxwellsantoro. Trust-aware repository facts for agents: build, test, docs, license, and security, no scraping.
It runs on your own machine: your AI client starts it from the MCP bundle package dotrepo-mcp-2.0.0-rc.1.mcpb at version 2.0.0-rc.1.
It asks for no keys or passwords.
Version 2.0.0-rc.1 was published on 27 October 2026, and the source code is public, so you can read it before installing.
Written from the registry entry. 8 automated checks on the registry entry and the package code: 6 pass, 0 warn, 0 fail, 2 info. How we check.
What it asks for
This server declares no environment variables, so it asks for no keys or settings.
Checks
| Check | Result | Detail |
|---|---|---|
| Source repository linked | Pass | https://github.com/maxwellsantoro/dotrepo |
| Version pinned | Pass | Every package has an explicit version |
| Secrets requested | Info | Asks for no secrets |
| Known package registry | Pass | All packages come from npm, PyPI, OCI, NuGet or MCPB |
| Namespace ownership | Info | Name verified via GitHub account maxwellsantoro |
| Registry text aimed at the AI | Pass | Description and settings contain no hidden characters or instructions to the AI |
| Code red flags | Pass | Read 1 files in the bundle: no obfuscation, encoded execution, credential reads or data-collection endpoints found |
| Text aimed at the AI | Pass | No hidden characters or instructions to the AI in 1 files, including comments and the README |
Popularity & health: 62 / 100
Worked out from public numbers and our own checks, not from user reviews or ratings. It says how used and how looked-after a server is, not whether it is safe.
0 forks, 96 merged pull requests. Sources: GitHub, npm, PyPI (pypistats.org) and Hacker News (Algolia), fetched 2026-10-31.
What people say
No Hacker News threads link to its source code.
Look further: search Reddit, search Hacker News, read its GitHub issues. These are not reviews we checked.
Facts
| Registry name | io.github.maxwellsantoro/dotrepo |
|---|---|
| Publisher | GitHub account maxwellsantoro |
| How the name is verified | Name verified via GitHub account maxwellsantoro. The registry ties the name prefix to that account or domain; it does not check the code. |
| Type | Local: runs on your machine from a package |
| Packages | mcpb https://github.com/maxwellsantoro/dotrepo/releases/download/v2.0.0-rc.1/dotrepo-mcp-2.0.0-rc.1.mcpb 2.0.0-rc.1 (stdio) |
| Version | 2.0.0-rc.1 |
| Published | |
| Last updated | |
| Source repository | https://github.com/maxwellsantoro/dotrepo |
| Website | https://dotrepo.org |
| Category | Security (assigned by keyword rule, not by hand) |
Related servers in Security
AgentDiet Coding Agent GitHub Repo, Dependency & License Security Auditor4/4Evaluates any GitHub repository for license risk, maintenance…
- zanadir4/4Find what a repository's CI is missing, and which security checks…
- ci-guard-mcp7/7Local-first static repository security and configuration drift…
- Feldspar free repository security scan4/4Free deterministic security scan of public git repos: OSV.dev…
- Repository Intelligence2/2Analyze repos of any size - security scanning code analysis…
- tech-risk4/4Free MCP security scan: tool-poisoning & prompt-injection audit…